@geminixiang/mikan 1.0.0-beta.21 → 1.0.0-beta.22

package/dist/vault/injection.js

@@ -1,7 +1,10 @@
 import { existsSync } from "fs";
 import { reportUserFacingError } from "../observability/sentry.js";
 export function resolveVaultInjection(options) {
-    const { vault, sandboxType, conversationId } = options;
+    const { vault, capabilities, sandboxType, conversationId } = options;
+    if (vault && vault.mounts.length > 0 && !capabilities.fileMounts) {
+        throw new Error(`Sandbox type "${sandboxType}" does not support vault file mounts`);
+    }
     const mounts = [];
     for (const mount of vault?.mounts ?? []) {
         if (!existsSync(mount.source)) {
@@ -21,7 +24,7 @@ export function resolveVaultInjection(options) {
         }
         mounts.push({ source: mount.source, target: mount.target });
     }
-    const env = sandboxType !== "host" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
+    const env = capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
     return { ...(env ? { env } : {}), mounts };
 }
 //# sourceMappingURL=injection.js.map

package/dist/vault/injection.js.map

@@ -1 +1 @@
-{"version":3,"file":"injection.js","sourceRoot":"","sources":["../../src/vault/injection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAiBnE,MAAM,UAAU,qBAAqB,CAAC,OAIrC;IACC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEvD,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;gBAChE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,gBAAgB;gBAC3B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW;oBACX,cAAc;oBACd,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;iBACzB;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,GAAG,GACP,WAAW,KAAK,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC","sourcesContent":["import { existsSync } from \"fs\";\nimport { reportUserFacingError } from \"../observability/sentry.js\";\nimport type { SandboxConfig } from \"../sandbox/types.js\";\nimport type { ResolvedVault, ResolvedVaultMount } from \"./types.js\";\n\n/**\n * What an actor's vault contributes to one sandbox execution. This is the\n * vault side of credential injection — the execution resolver composes it\n * with its own workspace layout and per-actor config shaping, without\n * knowing what a vault mount means or when vault env may flow.\n */\nexport interface VaultInjection {\n  /** Per-exec env; absent for host sandboxes (no isolation) and empty vaults. */\n  env?: Record<string, string>;\n  /** Credential mounts whose sources exist; missing sources are reported and skipped. */\n  mounts: ResolvedVaultMount[];\n}\n\nexport function resolveVaultInjection(options: {\n  vault: ResolvedVault | undefined;\n  sandboxType: SandboxConfig[\"type\"];\n  conversationId: string;\n}): VaultInjection {\n  const { vault, sandboxType, conversationId } = options;\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const mount of vault?.mounts ?? []) {\n    if (!existsSync(mount.source)) {\n      reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n        domain: \"sandbox\",\n        surface: \"vault_injection\",\n        operation: \"resolve_mounts\",\n        severity: \"warning\",\n        context: {\n          sandboxType,\n          conversationId,\n          target: mount.target,\n          hasVault: Boolean(vault),\n        },\n      });\n      continue;\n    }\n    mounts.push({ source: mount.source, target: mount.target });\n  }\n\n  const env =\n    sandboxType !== \"host\" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n  return { ...(env ? { env } : {}), mounts };\n}\n"]}
+{"version":3,"file":"injection.js","sourceRoot":"","sources":["../../src/vault/injection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAMnE,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACrE,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,sCAAsC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;gBAChE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,gBAAgB;gBAC3B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW;oBACX,cAAc;oBACd,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;iBACzB;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,GAAG,GACP,YAAY,CAAC,GAAG,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC","sourcesContent":["import { existsSync } from \"fs\";\nimport { reportUserFacingError } from \"../observability/sentry.js\";\nimport type { SandboxConfig, SandboxCredentialCapabilities } from \"../sandbox/types.js\";\nimport type { ResolvedVault, ResolvedVaultMount, VaultInjection } from \"./types.js\";\n\nexport type { VaultInjection } from \"./types.js\";\n\nexport function resolveVaultInjection(options: {\n  vault: ResolvedVault | undefined;\n  capabilities: SandboxCredentialCapabilities;\n  sandboxType: SandboxConfig[\"type\"];\n  conversationId: string;\n}): VaultInjection {\n  const { vault, capabilities, sandboxType, conversationId } = options;\n  if (vault && vault.mounts.length > 0 && !capabilities.fileMounts) {\n    throw new Error(`Sandbox type \"${sandboxType}\" does not support vault file mounts`);\n  }\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const mount of vault?.mounts ?? []) {\n    if (!existsSync(mount.source)) {\n      reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n        domain: \"sandbox\",\n        surface: \"vault_injection\",\n        operation: \"resolve_mounts\",\n        severity: \"warning\",\n        context: {\n          sandboxType,\n          conversationId,\n          target: mount.target,\n          hasVault: Boolean(vault),\n        },\n      });\n      continue;\n    }\n    mounts.push({ source: mount.source, target: mount.target });\n  }\n\n  const env =\n    capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n  return { ...(env ? { env } : {}), mounts };\n}\n"]}

package/dist/vault/types.d.ts

@@ -13,6 +13,10 @@ export interface ResolvedVault {
     /** Parsed from env file */
     env: Record<string, string>;
 }
+export interface VaultInjection {
+    env?: Record<string, string>;
+    mounts: ResolvedVaultMount[];
+}
 export interface VaultManager {
     /** Return true when a vault directory exists for this exact key. */
     hasEntry(key: string): boolean;

package/dist/vault/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;IACnD,8DAA8D;IAC9D,gDAAgD;IAChD,IAAI,IAAI,aAAa,EAAE,CAAC;IACxB,4CAA4C;IAC5C,SAAS,IAAI,OAAO,CAAC;IACrB,kFAAkF;IAClF,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,yFAAyF;IACzF,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F,6DAA6D;IAC7D,gBAAgB,IAAI,MAAM,EAAE,CAAC;IAC7B,+EAA+E;IAC/E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,wEAAwE;IACxE,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;IACnD,8DAA8D;IAC9D,gDAAgD;IAChD,IAAI,IAAI,aAAa,EAAE,CAAC;IACxB,4CAA4C;IAC5C,SAAS,IAAI,OAAO,CAAC;IACrB,kFAAkF;IAClF,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,yFAAyF;IACzF,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F,6DAA6D;IAC7D,gBAAgB,IAAI,MAAM,EAAE,CAAC;IAC7B,+EAA+E;IAC/E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,wEAAwE;IACxE,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD"}

package/dist/vault/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"","sourcesContent":["export interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n}\n\nexport interface VaultManager {\n  /** Return true when a vault directory exists for this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no directory exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  /** List all vaults discovered under vaults/. */\n  list(): ResolvedVault[];\n  /** Check if the vaults directory exists. */\n  isEnabled(): boolean;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n  /** List named shared login profiles under vaults/shared/. */\n  listSharedVaults(): string[];\n  /** Delete a shared login profile's directory. Returns true when it existed. */\n  deleteSharedVault(name: string): boolean;\n  /** Copy a shared login profile's files into another vault directory. */\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number };\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"","sourcesContent":["export interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n}\n\nexport interface VaultInjection {\n  env?: Record<string, string>;\n  mounts: ResolvedVaultMount[];\n}\n\nexport interface VaultManager {\n  /** Return true when a vault directory exists for this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no directory exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  /** List all vaults discovered under vaults/. */\n  list(): ResolvedVault[];\n  /** Check if the vaults directory exists. */\n  isEnabled(): boolean;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n  /** List named shared login profiles under vaults/shared/. */\n  listSharedVaults(): string[];\n  /** Delete a shared login profile's directory. Returns true when it existed. */\n  deleteSharedVault(name: string): boolean;\n  /** Copy a shared login profile's files into another vault directory. */\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number };\n}\n"]}

package/dist/web/admin/portal.js

@@ -8,7 +8,7 @@ import { readRawBody } from "../../utils/http-body.js";
 import { renderPortalShell } from "../portal-shell.js";
 import { resolveExistingSessionFile } from "../session-view/service.js";
 import { PRODUCT_NAME } from "../../platform-messages.js";
-import { actorKey } from "../../sandbox/identity.js";
+import { credentialAuthorizationKey } from "../../sandbox/identity.js";
 import { sharedVaultKey } from "../../vault/index.js";
 import { modelKey, resolveAdminModelAccessStatuses } from "./provider-models.js";
 // ── Handler ────────────────────────────────────────────────────────────────────
@@ -692,7 +692,7 @@ function serveConversationLoginLink(res, body, services, token) {
     }
     else {
         try {
-            vaultId = actorKey(services.sandbox, {
+            vaultId = credentialAuthorizationKey(services.sandbox, {
                 userId: token.platformUserId,
                 conversationId: scope.conversationId,
             });